iPhone. Image: Ellica/Shutterstock
An iCloud hack discovered in August by AdaptiveMobile has “increased hugely” in recent weeks, with users in the US hit with charges, and users in China flooded with spam.
A hack into Apple users’ iCloud accounts – and the subsequent access to said users’ phone numbers – has made for a costly few months in the US, and an annoying few months in China.
AdaptiveMobile’s earlier news surrounding the hack found that 3,200 phone numbers in North America were affected in July and August, with these sending over 280k spam SMS messages, as well as an unknown quantity of iMessage spam.
Since then, however, there was a large escalation in sending activity. Cumulatively (including July and August) by mid-October, the company had detected over 11,500 phone numbers that sent over 750k SMS messages.
The scam is simple: iCloud accounts are being hacked and paired iPhones are then sending spam messages. The damage in this is limited, but Apple’s ‘Send as SMS’ feature is where the problem comes in.
The concern is that the feature is used if the recipient iPhone is not reachable anymore using iMessage, so an SMS is sent instead. When the SMS is sent, the sender is charged and the hackers win, over and over again.
AdaptiveMobile, an Irish cybersecurity company, claims these spam attacks are becoming more broad – the initial messages offered counterfeit luxury goods, and have now expanded to promote gambling sites.
“The fact that now there are now multiple different spam ‘campaigns’ is worrying,” said Cathal McDaid, CIO at AdaptiveMobile.
“This is always a sign that attempts are being made to broaden the scope of what can be done with these hacked iCloud accounts.”
It’s not just hitting US users, either, with similar evidence emerging in European and Asian countries as well.
@bet365 I don’t have an account. But your affiliate has been sending out your links through my phone! (and @bwin) pic.twitter.com/U1ZtVvBz0j
— Cathrine Svendsen (@CathrinSvendsen) September 15, 2016
Interestingly, the more iCloud accounts hacked, the less intensive the spamming is – with the hackers seemingly sending less spam per account, in a bid to prove more effective.
“It is probable that attackers access people’s iCloud accounts through known forms of social engineering,” said McDaid.
“What concerns us is the fact that people whose accounts have been compromised could potentially be billed hundreds or thousands of dollars after the attack has taken place.”
Various reports of iCloud hacks have emerged in the US of late. In Texas, users have been warned not to open messages looking for them to log in to their iCloud, as a spate of incidents have seen users’ accounts compromised.
The advice AdaptiveMobile gives to Apple users is pretty straightforward: go to your Apple ID login, change your password and unlink any devices that are not yours.
